The Great Cookie Hangover

Hardly any Austrian website today manages without that grey layer over its content. Two clicks later nobody is any wiser: the visitor only wanted the opening hours, the company receives numbers it never looks at anyway. The banner is never the cause – it is the invoice for a decision taken long before: this site collects more than it needs.

The way out is less comfortable than it sounds, because it does not start with the design of the banner but with the question of which tools get built in at all. In exchange it lasts: whatever is never collected needs neither explaining nor managing nor defending.

No – at least not automatically. In Austria, a consent banner only becomes necessary once a website stores information on the terminal device, or reads information from it, that is not strictly required for the service the visitor explicitly asked for. If a page opens no such connections, there is nothing to consent to.

In Austria the legal basis is section 165 of the Telecommunications Act 2021 rather than the GDPR in the first instance – a distinction that regularly gets lost in practice. The provision hinges on access to the terminal device, not on personal data. That is why even an anonymous counter requires consent as soon as it stores something in the browser. Conversely, the basket cookie without which a shop cannot function falls under the exemption for strictly necessary storage.

In practical terms: the cookie banner is a symptom, not a compulsory exercise. Getting rid of it is not a matter of prettier consent design but of removing the reason. In our relaunch for LASACO that was precisely the lever: locally hosted fonts, no third-party scripts – and therefore nothing anyone would have to agree to.

Consent is only valid if it is freely given, informed and tied to a specific purpose – and if withdrawing it is as easy as granting it. A banner where “accept all” glows and “reject” sits behind two submenus does not meet that standard, however dutifully it logs a yes.

The quickest test takes five seconds: count the clicks needed to reject and compare them with the clicks needed to accept. If there are more, the design is already skewed. Then come the usual devices – a coloured accept button next to a grey link, pre-ticked switches for “legitimate interest”, a close control that is counted as agreement. Such dark patterns are not a grey area of design; they are the reason a documented consent turns out to be worthless when it matters.

The second test is simpler still: look for the place where consent already given can be taken back. If it cannot be found within a few seconds, that agreement was never equally withdrawable.

Nothing – and that is exactly the point. After a refusal, none of the affected connections may be opened, not even “just to load”. In practice this is the most common gap: the banner appears, consent is requested, and the scripts have long since loaded because they sit hard-coded in the page head. To check whether your own site is clean, open the browser network panel, refuse, and see which external domains are contacted anyway.

Nor may a refusal block access to the content or noticeably degrade it. Models that offer a subscription instead are legally contested and, for small and medium-sized firms, hardly a sensible answer to a problem that can be solved at the toolbox.

It costs trust first, then attention, and finally data quality. Opening a website with an obstacle demands a decision before any benefit has been delivered. And because a share of visitors decline, the remaining numbers describe a selection rather than the audience.

Then there is the technical bill. Every embedded third-party script is an extra connection, an extra code path and an extra reason why a page responds later than it needs to. Consent management tools are particularly awkward here because by definition they have to run early – ahead of the content that is the actual point. So the banner slows down precisely the seconds in which somebody decides whether to stay.

Finally there is the effort nobody budgets for: documenting consent, maintaining categories, updating after every new tool, keeping the wording current in two languages. That is not a one-off task but a permanent one. It disappears entirely once there is nothing left to consent to.

Often further than the banner suggests. Many widespread analytics and advertising tools transmit to providers subject to a legal order outside the EU. In 2020 the Court of Justice of the European Union sharpened the requirements for such transfers considerably in the Schrems II case – since then the choice of provider has been a data protection decision, not a matter of taste.

In practice the exact legal construction matters less than the question behind it: do you want that dependency at all? An analytics tool that runs on a server inside the EU and never passes the data on makes the whole chain of assessment unnecessary – EU hosting is not a label here but a simplification.

The second blind spot is the tools nobody perceives as tracking: an embedded map, a video, a typeface from someone else's server, a chat window. All of them open a connection when the page loads and transmit at least the IP address. Serving fonts locally and loading videos only after a click solves a surprisingly large share of the problem – and is faster into the bargain. This article is not legal advice, however; where concrete contracts are involved, a legal review belongs in the process.

Usually far less than is built in. The GDPR requires data minimisation: personal data must be adequate for the purpose and limited to what is necessary. Translated into everyday terms – every tool has to answer a question you genuinely ask and from which a decision follows.

In our experience these five questions sort out a typical toolbox faster than any debate of principle. What remains is often a single analytics tool – and for that there are consent-free variants that work without an identifier in the browser and therefore trigger no banner at all.

The honest framing matters here: consent-free analytics delivers less. It shows which content gets read, where visits come from and where people drop off. It does not show which individual person was already there three weeks ago. For most company websites that is no loss but a release – for a large shop running multi-stage campaigns it may well be one. That trade-off deserves a deliberate decision rather than a default setting.

In four steps, none of which starts with the banner: an inventory of all outgoing connections, a decision per tool, replacement or removal, and a re-measurement. At the end there is either a page with no consent request at all – or a banner that appears only for what you deliberately kept.

Honestly: not every website ends up without a banner. A shop with a payment provider, a page with an embedded booking flow, a campaign that has to be reconciled reliably against advertising platforms – those are real reasons. The difference is that the banner then appears for three deliberately chosen services instead of eighteen that grew there over the years.

How we build websites so the question never arises is set out on our service page; the terminology around consent, tracking and third-country transfers is explained in the glossary. And if you want to know what actually loads on your site: send us the address, we will look and tell you honestly what can go. Arrange a call.